Airdrop scams explained: drainers, fake claims and how to stay safe

Airdrops attract scammers for a simple reason: the victim expects to be asked to connect a wallet and press a button. The attacker only has to make that button do something different from what you think. The rest of this page is about how that swap is done and how to catch it.

Anatomy of a drainer attack

A wallet drainer is a kit sold or rented to scammers. It supplies a front-end that imitates a real claim page, and a script that inspects the wallet connecting to it, picks the most valuable assets and builds the signature request that moves them. The kit does the thinking, so the attacker needs no technical skill. That is why the same pattern repeats everywhere.

Notice what is missing: no password, no seed phrase, no malware. Everything happens through standard wallet features that real applications also use. That is the reason defence has to focus on the signature screen and on where the link came from.

What the malicious signature actually does

Four mechanisms account for most drainer losses. All of them are normal token features described in public standards. Understanding them removes the mystery.

ERC-20 approve

The EIP-20 standard lets a token holder authorise a spender to withdraw tokens up to a set amount, multiple times, using approve. The spender then moves tokens with transferFrom without asking again (EIP-20). A drainer asks you to approve its own address, frequently for the maximum amount. Ethereum.org tells users not to allow unlimited spend limits for this reason (ethereum.org security).

NFT setApprovalForAll

For NFTs, setApprovalForAll enables an operator to manage all of the caller’s tokens in that collection. The EIP-721 text says an operator can do what the owner can with the NFTs it covers, including transferring them (EIP-721). A fake mint or claim page that asks for this is not asking to receive anything. It is asking for control of your whole collection. A genuine marketplace does use this call, but a free claim page has no reason to.

EIP-2612 permit signatures

EIP-2612 adds a permit function that sets an allowance from a signed message instead of a transaction. The signature covers the owner, spender, value, nonce and deadline, and anyone can submit it, because the signature rather than the sender authorises the approval (EIP-2612). The trap: signing costs no gas, so the popup feels like logging in. There is no transaction to inspect and nothing visible on a block explorer until the attacker submits it. A deadline set to the maximum value effectively removes expiry.

Permit2 signatures

Permit2 is a Uniswap contract with two modules. SignatureTransfer authorises a single transfer; AllowanceTransfer stores a standing allowance with an amount and expiration (Uniswap docs). Because users usually give Permit2 a one-time large approval per token, a single signed message can then authorise a spender across a token you have used with Uniswap-style apps. Revoke.cash notes that Permit2 can approve multiple tokens at once, which makes it harder to understand what you are authorising, and that phishing sites exploit that confusion (Revoke.cash).

Blind signing

Blind signing means confirming data your wallet cannot present in human-readable form, typically a raw hex message or an unrecognised contract call. Typed-data requests (EIP-712) are displayed as fields, which helps, but only if you read them. Our editorial rule: if the screen shows a spender address you do not recognise, a huge amount, or a request that does not match the page you are on, treat that as a rejection, not a puzzle to figure out.

Six ways victims reach the malicious page

Fake claim sites and typosquatting

Domains that differ from the real one by a swapped letter, an extra word (“claim”, “rewards”), a different top-level domain, or a lookalike character. Paid search ads and sponsored results sometimes place them above the genuine link. Bookmark the official site once, from the project documentation, and use the bookmark.

Fake X, Discord and Telegram announcements

Hacked accounts of real projects, cloned accounts with a near-identical handle, and fake “snapshot” or “claim is live” posts in community channels. Ethereum.org warns that link previews on X can be spoofed to show a trusted domain while redirecting elsewhere (source). Our guide to Telegram airdrops covers that platform’s specific traps.

Poisoned tokens, dust and unexpected NFTs

Tokens appear in your wallet without action on your part. The token name or metadata contains a URL, or a block explorer entry pushes you to a “claim your reward” page. Ethereum.org lists this as an airdrop scam variant: unsolicited tokens or NFTs leading to sites that request a signature or approval (source). Ignoring the token is enough. See also NFT airdrops.

Fake support DMs

You post a question in a public channel and within minutes a “moderator” messages you. Ethereum.org notes impersonators approach users through private messages after spotting help requests and that real staff do not contact people through unofficial private channels. Treat every unsolicited DM as hostile.

Malicious browser extensions and fake wallet apps

A cloned wallet extension or an “airdrop tracker” extension can read page content or request permissions to read every site you visit. Ethereum.org advises installing extensions only from trusted sources and removing unused ones. Do not install anything recommended in a DM or a comment.

Seed-phrase phishing

A page or “support” agent asks you to enter your recovery phrase to “verify” or “restore” eligibility. This is the oldest scam and still works. It is covered in its own section below.

The 10-second check

You will not run a forensic investigation before every claim. You can run a short routine that blocks the majority of attacks. Tick the items as you rehearse them; the progress is saved in your browser only.

The burner step matters more than it looks. Even a careful person eventually signs something wrong; the question is what is exposed when that happens. A wallet that holds only farming assets limits the loss. Read the burner wallet guide for a clean setup.

Red flags: why they work and what to do

Seed phrase phishing and extension risk

Your recovery phrase is not a password you can reset. Ethereum.org says never to share it for any reason, that anyone holding it can drain your accounts, and that you should avoid screenshots because they may sync to cloud storage (source). The practical consequence: a site, form, chatbot or person asking for the phrase is a scam in every case. Signing and connecting never require it.

Extensions deserve the same suspicion. A browser extension can be granted access to read and change data on sites you visit, so a malicious one can swap a destination address or present a different page than the one the site sent. Keep few extensions and use a separate browser profile for farming. Our judgement: a profile containing only your wallet extension is cheap protection.

If you already signed a malicious request

Speed matters. Drainers often sweep within minutes, and some wait. Work in this order.

1. Stop interacting. Close the page. Do not sign anything further, including “recovery” offers from strangers, which are a second scam aimed at the same victim.
2. Create a fresh wallet on a clean device or browser profile. Never reuse the old seed phrase if it was typed anywhere.
3. Move what is still movable. Send the most valuable remaining assets from the exposed wallet to the new one. You pay gas from the exposed wallet, so keep a little native token for that.
4. Revoke the approval. Use Revoke.cash or a block explorer approval checker for each chain, as covered in our revoke guide. Ethereum.org notes that revoking requires a transaction, so you pay a network fee, and that disconnecting a wallet does not remove token permissions (source).
5. If you entered a seed phrase anywhere, treat the entire wallet as burned. Revoking does not help; the attacker holds the key. Migrate everything.
6. Report. Chainabuse accepts reports about addresses, URLs and other identifiers and supports private reporting for sensitive cases. It says reporting warns the community but does not replace a law enforcement investigation (Chainabuse). Also file with your local authority and report the phishing domain to its host and registrar.

What we would do by default

These are editorial choices rather than rules from a standard.

• Treat every claim as hostile until the link is traced back to official documentation. Our process for tracing is in how to know an airdrop is legitimate.
• Separate wallets by purpose. Farming wallet, holding wallet, and nothing shared between them.
• Review approvals monthly. Old allowances are the quiet risk. A broad approval signed last year still works today.
• Prefer exact amounts over unlimited ones when the interface lets you edit the spending cap, and expect to approve again later.
• Check our own lists the same way. Our verification method explains how we confirm sources, and the claims page is a starting point, not a substitute for your own check.

If you want to keep up with what is live, the latest airdrops list is a better starting point than a DM, and what an airdrop is covers how real distributions normally work, which makes fake ones easier to spot.

Written and fact-checked by the airdrop.promo Editorial Team. Method: how we verify. Spotted an error? contacts@airdrop.promo. Educational content only, not financial or tax advice.